- What: The Canadian Cyber Centre reports active exploitation of CVE-2026-48842, a pre-auth SQL injection in the Roundcube Webmail virtuser_query plugin caused by a preg_replace() backslash escape bypass.
- Impact: An unauthenticated attacker can run arbitrary SQL against the Roundcube database backend, exposing mail account credentials and stored message data.
- Fix / mitigation: Upgrade to Roundcube 1.6.16 or 1.7.1 (released May 2026), or disable the virtuser_query plugin until you can.
- Who's at risk: Organizations running Roundcube 1.6.x before 1.6.16 or 1.7.x before 1.7.1 with the virtuser_query plugin enabled, including hosting providers, universities and government mail.
A Roundcube Webmail bug patched four months ago is now being used in real attacks. The Canadian Centre for Cyber Security updated its advisory this week to say CVE-2026-48842 (CVSS 8.1) is being actively exploited in the wild, citing open-source reporting. The flaw is a pre-authentication SQL injection: no account, no session, no phishing step. If your Roundcube server runs an affected version with the virtuser_query plugin enabled, an attacker can reach your mail database from the login page.
What is affected
- Roundcube Webmail 1.6.x before 1.6.16
- Roundcube Webmail 1.7.x before 1.7.1
- Only deployments that enable the virtuser_query plugin, which maps login names to mailbox identities through a SQL lookup
- Fixed in 1.6.16 and 1.7.1, both released in May 2026
virtuser_query ships with Roundcube but is opt-in. It is common in hosting and multi-domain setups where the address a user types at login has to be resolved to a real mailbox or identity through a database table. That profile, many tenants behind one webmail front end, is also where a database dump does the most damage.
How the injection works
The plugin builds its lookup query by substituting the user-supplied login value into an administrator-defined SQL template. Before substitution, the input passes through a preg_replace() based escape routine. According to the advisory, attackers can defeat that routine with a crafted backslash sequence, so a quote character survives escaping and breaks out of the string literal. From there, the attacker appends arbitrary SQL.
Because the lookup runs while resolving the login name, it executes before any password check. SentinelOne summarized the result: unauthenticated attackers can inject SQL into Roundcube's database backend, potentially exposing mail account credentials and stored messages. What the attacker can read or write depends on the privileges of the database account Roundcube uses, which in many installs is broader than it needs to be.
The Cyber Centre has not published indicators, actor names, or payloads for this campaign. Treat any unpatched server with virtuser_query enabled as potentially compromised, not just exposed, and review it accordingly.
Exposure by the numbers
Shadowserver Foundation data shows more than 523,000 Roundcube instances reachable from the internet. As of September 23, 2026, it flagged 10 of them as vulnerable to this CVE. That small number reflects what can be fingerprinted remotely: whether virtuser_query is enabled is not visible from the outside, so the true count of exploitable hosts is unknown. The number to care about is your own, and the check below answers it in under a minute.
Why Roundcube keeps getting hit
Webmail is a direct line to an organization's correspondence, and Roundcube sits at the edge on hundreds of thousands of servers. That makes it a recurring target:
- February 2026: CISA added CVE-2025-49113 and CVE-2025-68461, both Roundcube flaws, to its Known Exploited Vulnerabilities catalog.
- July 2026: Proofpoint reported a suspected China-aligned actor, tracked as UNK_MassTraction, exploiting known Roundcube vulnerabilities to drop web shells and the VShell post-exploitation tool.
- September 2026: CVE-2026-48842 confirmed exploited, four months after the fix shipped.
The pattern is consistent. Actors are not waiting for zero-days. They work the gap between release and deployment, and Roundcube installs are often left on a distribution package or a hand-installed tarball that nobody owns.
What to do now
- Inventory every Roundcube install, including distro packages under /usr/share/roundcube and tarball installs under /var/www.
- Confirm the version. Anything on 1.6.x below 1.6.16 or 1.7.x below 1.7.1 is in scope.
- Check whether virtuser_query appears in the plugins array or config. If it does, that host is exploitable until patched.
- Upgrade to 1.6.16 or 1.7.1. If you run a distro package, confirm your vendor has shipped or backported the fix before trusting the package version.
- If you cannot upgrade today, remove virtuser_query from the plugins list and reload PHP. Logins that depend on the mapping will break, which is the right trade-off against a pre-auth database read.
- Reduce the Roundcube database account to the privileges it needs, and keep it off any database that also holds other application data.
Rotate the Roundcube database credentials and the des_key in config.inc.php, force password resets for mailbox users on that host, and search the web root for files you did not deploy, given that prior Roundcube campaigns dropped web shells.
Bottom line
CVE-2026-48842 is narrow in scope, one opt-in plugin, but severe where it applies: unauthenticated database access on the server holding your mail. The patch has been out since May. If you run virtuser_query, patch or disable it today, then look back through your logs for the window you were exposed.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us